mirror of https://github.com/google/oss-fuzz.git
Initial integration (#7584)
This commit is contained in:
psy
GitHub
parent
45d1d61baa
commit
7a0502fb71
|
|
@ -0,0 +1,32 @@
|
|||
# Copyright 2022 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
#
|
||||
################################################################################
|
||||
|
||||
FROM gcr.io/oss-fuzz-base/base-builder-jvm
|
||||
|
||||
RUN curl -L https://downloads.apache.org/maven/maven-3/3.6.3/binaries/apache-maven-3.6.3-bin.zip -o maven.zip && \
|
||||
unzip maven.zip -d $SRC/maven && \
|
||||
rm -rf maven.zip
|
||||
|
||||
RUN git clone --depth 1 https://github.com/apache/httpcomponents-client
|
||||
|
||||
ENV MVN $SRC/maven/apache-maven-3.6.3/bin/mvn
|
||||
|
||||
WORKDIR httpcomponents-client
|
||||
RUN git clone --depth 1 https://github.com/apache/httpcomponents-core
|
||||
RUN git clone --depth 1 https://github.com/qos-ch/slf4j
|
||||
|
||||
COPY build.sh $SRC/
|
||||
COPY HttpFuzzer.java $SRC/
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
import com.code_intelligence.jazzer.api.FuzzedDataProvider;
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
import java.net.URI;
|
||||
import java.io.IOException;
|
||||
|
||||
import org.apache.hc.core5.http.io.support.ClassicRequestBuilder;
|
||||
import org.apache.hc.client5.http.impl.classic.HttpClients;
|
||||
import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
|
||||
import org.apache.hc.client5.http.impl.auth.CredentialsProviderBuilder;
|
||||
import org.apache.hc.client5.http.auth.CredentialsProvider;
|
||||
import org.apache.hc.client5.http.auth.AuthScope;
|
||||
import org.apache.hc.client5.http.classic.methods.HttpPost;
|
||||
import org.apache.hc.core5.http.ClassicHttpRequest;
|
||||
import org.apache.hc.core5.http.message.BasicNameValuePair;
|
||||
import org.apache.hc.core5.http.NameValuePair;
|
||||
import org.apache.hc.client5.http.entity.UrlEncodedFormEntity;
|
||||
|
||||
public class HttpFuzzer {
|
||||
public static void fuzzerTestOneInput(FuzzedDataProvider data) {
|
||||
final CredentialsProvider credsProvider = CredentialsProviderBuilder.create()
|
||||
.add(new AuthScope(data.consumeRemainingAsString(), data.consumeInt()), data.consumeRemainingAsString(), data.consumeRemainingAsString().toCharArray())
|
||||
.build();
|
||||
|
||||
final CloseableHttpClient httpClient = HttpClients.custom()
|
||||
.setDefaultCredentialsProvider(credsProvider)
|
||||
.build();
|
||||
|
||||
HttpPost httpPost = new HttpPost("http://localhost");
|
||||
List<NameValuePair> nvps = new ArrayList<>();
|
||||
nvps.add(new BasicNameValuePair(data.consumeRemainingAsString(), data.consumeRemainingAsString()));
|
||||
|
||||
httpPost.setEntity(new UrlEncodedFormEntity(nvps));
|
||||
|
||||
try {
|
||||
httpClient.execute(httpPost);
|
||||
} catch (IOException e) { }
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
#!/bin/bash -eu
|
||||
# Copyright 2022 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
#
|
||||
################################################################################
|
||||
|
||||
|
||||
MAVEN_ARGS="-Djavac.src.version=15 -Djavac.target.version=15 -DskipTests"
|
||||
$MVN package $MAVEN_ARGS
|
||||
CURRENT_VERSION=$($MVN org.apache.maven.plugins:maven-help-plugin:3.2.0:evaluate \
|
||||
-Dexpression=project.version -q -DforceStdout)
|
||||
cp "httpclient5/target/httpclient5-$CURRENT_VERSION.jar" "$OUT/httpclient5.jar"
|
||||
|
||||
$MVN package $MAVEN_ARGS -f "httpcomponents-core/pom.xml"
|
||||
CURRENT_VERSION=$($MVN org.apache.maven.plugins:maven-help-plugin:3.2.0:evaluate \
|
||||
-Dexpression=project.version -q -DforceStdout -f httpcomponents-core/pom.xml)
|
||||
cp "httpcomponents-core/httpcore5/target/httpcore5-$CURRENT_VERSION.jar" "$OUT/httpcore5.jar"
|
||||
cp "httpcomponents-core/httpcore5-h2/target/httpcore5-h2-$CURRENT_VERSION.jar" "$OUT/httpcore5-h2.jar"
|
||||
|
||||
cd slf4j
|
||||
$MVN package $MAVEN_ARGS
|
||||
CURRENT_VERSION=$($MVN org.apache.maven.plugins:maven-help-plugin:3.2.0:evaluate \
|
||||
-Dexpression=project.version -q -DforceStdout)
|
||||
cp "slf4j-api/target/slf4j-api-$CURRENT_VERSION.jar" "$OUT/slf4j.jar"
|
||||
cd $SRC
|
||||
|
||||
ALL_JARS="httpclient5.jar httpcore5.jar slf4j.jar httpcore5-h2.jar"
|
||||
|
||||
# The classpath at build-time includes the project jars in $OUT as well as the
|
||||
# Jazzer API.
|
||||
BUILD_CLASSPATH=$(echo $ALL_JARS | xargs printf -- "$OUT/%s:"):$JAZZER_API_PATH
|
||||
|
||||
# All .jar and .class files lie in the same directory as the fuzzer at runtime.
|
||||
RUNTIME_CLASSPATH=$(echo $ALL_JARS | xargs printf -- "\$this_dir/%s:"):\$this_dir
|
||||
|
||||
for fuzzer in $(find $SRC -name '*Fuzzer.java'); do
|
||||
fuzzer_basename=$(basename -s .java $fuzzer)
|
||||
javac -cp $BUILD_CLASSPATH $fuzzer
|
||||
cp $SRC/$fuzzer_basename.class $OUT/
|
||||
|
||||
# Create an execution wrapper that executes Jazzer with the correct arguments.
|
||||
echo "#!/bin/sh
|
||||
# LLVMFuzzerTestOneInput for fuzzer detection.
|
||||
this_dir=\$(dirname \"\$0\")
|
||||
LD_LIBRARY_PATH=\"$JVM_LD_LIBRARY_PATH\":\$this_dir \
|
||||
\$this_dir/jazzer_driver --agent_path=\$this_dir/jazzer_agent_deploy.jar \
|
||||
--cp=$RUNTIME_CLASSPATH \
|
||||
--target_class=$fuzzer_basename \
|
||||
--jvm_args=\"-Xmx2048m\" \
|
||||
\$@" > $OUT/$fuzzer_basename
|
||||
chmod u+x $OUT/$fuzzer_basename
|
||||
done
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
homepage: "https://github.com/apache/httpcomponents-client"
|
||||
language: jvm
|
||||
primary_contact: "patrice.salathe@code-intelligence.com"
|
||||
auto_ccs:
|
||||
- "wagner@code-intelligence.com"
|
||||
- "yakdan@code-intelligence.com"
|
||||
- "glendowne@code-intelligence.com"
|
||||
- "patrice.salathe@code-intelligence.com"
|
||||
fuzzing_engines:
|
||||
- libfuzzer
|
||||
main_repo: "https://github.com/apache/httpcomponents-client.git"
|
||||
sanitizers:
|
||||
- address
|
||||
Loading…
Reference in New Issue